End-to-end encryption
Secrets are encrypted in your browser using AES-256-GCM. The decryption key never touches our servers.
Secret sharing, without the trail
Credentials should disappear after they are read.
Send API keys and passwords through a one-time link. Encrypted in your browser, then permanently deleted after viewing.
Encrypted before it leaves your device Destroyed after one read
One-time secretEncrypted locally
Production API key
apikeypro.com/s/••••••••••ONE READ
Read once. Ciphertext removed.
Built around the handoff
A safer way to pass something sensitive.
Move a secret out of chat and give it a clear end point.
Burn after reading
After consumption, the exchange cannot be opened again. Revoke a credential at its source if access must end.
Workspace audit log
Track when secrets are created, viewed, expired, or revoked with full IP and actor visibility.
Made for the whole team
Workspaces bring your team a shared vault, admin dashboard, custom subdomain, and audit log.
A simple exchange
Three steps. No plugins. No integrations.
No server ever sees your plaintext.
Encrypt in-browser
Your secret is encrypted using AES-256-GCM in your browser before a single byte leaves your device.
Share one link
You get a one-time link. The decryption key lives in the URL fragment, invisible to our servers.
Read once, gone forever
The recipient opens the link, decrypts locally, and the ciphertext is permanently deleted.
Straightforward plans
Start free. Add your team when you need it.
Individual accounts are free with up to 12 secrets per year. Team workspaces are $39 per month for up to 50 seats.
Individual
$0
Free, with up to 12 secrets per year.
Workspace
$39 / month
Up to 50 seats, with a shared vault and team controls.
Good to know
Questions, answered.
Clear details about how a one-time secret handoff works.
What is API Key Pro?
API Key Pro is a zero-knowledge secret exchange for sharing API keys, passwords, and credentials. Secrets are encrypted in your browser with AES-256-GCM, stored only as ciphertext, and permanently destroyed the moment they are read.
How does burn-after-reading work?
You encrypt a secret in your browser and share a one-time link. When the recipient opens it, their browser decrypts the secret locally and the ciphertext is immediately and permanently deleted from the database. Unread secrets are also swept after 7 days.
Can API Key Pro read my secrets?
No. The decryption key lives only in the URL fragment of the share link and never reaches our servers. We store ciphertext we cannot decrypt, so it is technically impossible for us to read your secrets.
How much does API Key Pro cost?
Individual accounts are free with up to 12 secrets per year. Team workspaces are $39 per month for up to 50 seats.
Do recipients need an account?
No. Anyone can open a one-time link and read a secret sent to them without creating an account.
A practical guide to sharing API keys safely
API Key Pro is a browser-based tool for one-time credential handoffs. It helps individuals and teams send a sensitive value without leaving a readable copy in an ordinary email thread or chat history. Use it for delivery, not as a replacement for a secrets manager, credential rotation, or access controls.
What is encrypted secret sharing?
A secret is a sensitive value such as an API key, password or access token. Encryption turns that readable value, called plaintext, into ciphertext. API Key Pro uses the browser's Web Crypto API with AES-256-GCM. The application sends encrypted content to the server rather than the plaintext you entered. The recipient needs the matching decryption material to read it.
How do one-time links and recipient delivery differ?
A one-time link carries decryption material in its URL fragment, the part after the # character. Browsers do not include that fragment in the HTTP request to the server. Treat the complete link as a credential: anyone who obtains a usable bearer link may be able to open it. Recipient-ID delivery instead addresses an account inbox and requires the intended recipient to sign in.
When is a secret removed?
Successful one-time access removes the active exchange so it cannot be opened again through the application. Link retrieval consumes the exchange when the encrypted payload is fetched. Account-inbox delivery uses a preview and confirmation sequence so a failed browser decryption does not consume the message. Unread exchanges have expiry limits. Deletion from an active exchange does not revoke a credential at its issuing provider or erase a copy the recipient has already saved.
What are the limits of browser encryption?
Encryption protects the message during this handoff; it does not make an infected laptop, compromised browser extension or exposed share link safe. Check the destination domain and recipient before sending. Avoid placing full share links in analytics, support requests or shared logs. For a high-impact key, use a second channel to confirm who will receive it and rotate it after the handoff when appropriate.
How should I prepare a credential handoff?
- Create a dedicated, least-privilege credential at the service that issues it. Avoid sending an organisation-wide administrator key when a narrowly scoped token will do.
- Confirm whether you are using a one-time link or a named recipient inbox. Verify the destination with the person who will receive the credential.
- Send the secret through API Key Pro, then share only the intended delivery link or recipient details. Do not paste the plaintext into the accompanying chat.
- Confirm receipt, revoke unnecessary credentials and follow your organisation's rotation policy. If you suspect exposure, revoke the original credential immediately.
Definitions and further reading
- Ciphertext
- The encrypted form of a message, rather than its readable plaintext.
- Credential rotation
- Replacing an existing password or token, and revoking the old value at its issuing service.
- One-time exchange
- A delivery mechanism that removes application access after consumption, not a guarantee against copying on the recipient's device.
These independent references explain the underlying concepts. They are not endorsements, certifications or an independent audit of API Key Pro.
- NIST: the Advanced Encryption Standard (FIPS 197)
- MDN: Web Crypto encryption and AES-GCM
- MDN: how URL fragments work
- OWASP: secrets management, rotation and revocation
Read our privacy policy and terms of service, or contact the team about a specific requirement.